A resort chain runs guest Wi-Fi through 40 controllers, each showing its own splash page, and the current flow leaves AUP acceptance unrecorded while returning guests must re-register on every visit. Security wants one portal that records the AUP and lets returning guests authenticate without re-registering until their guest account expires. Which web authentication design should the chain standardize on?

Central web authentication with the ISE guest portal consolidates the experience across the 40 controllers, while AUP capture records each guest’s acceptance. Guest accounts with an expiry time let returning guests authenticate with their existing account until it expires, meeting both the security and usability requirements. Controller-hosted local pages can capture AUP acceptance and support repeat logins with expiring accounts, but they leave the resort with separate portals rather than the required single centralized portal. Central ISE authentication and AUP capture with accounts that never expire supports convenient return visits, but it fails the explicit account-expiration requirement and leaves access active indefinitely unless separately revoked. Expiring accounts that must be recreated after every visit satisfy the central-portal, AUP, and expiry requirements, but confuse account expiration with session termination: a returning guest should be able to authenticate again using the still-valid account, not register anew. Exam caveat: distinguish the guest account’s lifetime from the duration of an individual Wi-Fi session; ending a session need not expire the account. Practical check: test across two controllers that AUP acceptance is recorded, a guest can disconnect and reconnect without registering again, and the account stops authenticating after its configured expiry.